Local System Accounts Discovery - MacOs

{
  "selection_dscl": {
    "Image
| endswith": "/dscl",
    "CommandLine
| contains
| all": [
      "list",
      "/users"
    ]
  },
  "selection_dscacheutil": {
    "Image
| endswith": "/dscacheutil",
    "CommandLine
| contains
| all": [
      "-q",
      "user"
    ]
  },
  "selection_root": {
    "CommandLine
| contains": "'*:0:'"
  },
  "selection_passwd_sudo": {
    "Image
| endswith": [
      "/cat",
      "/awk",
      "/grep"
    ],
    "CommandLine
| contains": [
      "/etc/passwd",
      "/etc/sudoers"
    ]
  },
  "selection_id": {
    "Image
| endswith": "/id"
  },
  "selection_lsof": {
    "Image
| endswith": "/lsof",
    "CommandLine
| contains": "-u"
  },
  "selection_logged_in_users": {
    "Image
| endswith": [
      "/who",
      "/w",
      "/users",
      "/last"
    ]
  },
  "selection_home_dir_listing": {
    "Image
| endswith": "/ls",
    "CommandLine
| endswith": [
      "/Users",
      "/Users'",
      "/Users\""
    ]
  },
  "selection_loginwindow_prefs": {
    "Image
| endswith": [
      "/defaults",
      "/plutil"
    ],
    "CommandLine
| contains": "com.apple.loginwindow"
  },
  "condition": "1 of selection*"
}

False Positives

• ⚠ Legitimate administration activities